Everything Needs to be Secure. But how?
If you read our previous article, you know why we need a shield. But for those who didn’t, we have a quick activity.
Go to this URL, see what’s in there, and come back. (This is for educational purposes only.)
https://www.shodan.io/search?query=webcamXP
Back?
All those webcam feeds are publicly accessible on the internet. Imagine if your webcam was there. This is just the tip of the iceberg.
Isn’t there anything we can do? There is. In this article, let’s dive into the following.
- Cryptography
- Zero Trust Architecture
- Penetration testing
Cryptography - protect the data itself
When you create a password for your accounts, how do you think they are saved? Just as plain text in a database? What if someone gets access to the database? Now your whole account is gone. Instead, they are saved as cryptographically encrypted data.
Cryptography is the science of transforming readable data into an unreadable form, preventing unauthorized access and tampering. It takes plaintext, applies an algorithm to encrypt it and sends the resulting ciphertext. At the receiving end, it is decrypted.
There are 3 types of cryptography,
- Symmetric key cryptography - Uses the same key to encrypt and decrypt (see the image above). E.g. — DES, AES
- Asymmetric key cryptography - One key is used to encrypt (Public key) and a separate key is used to decrypt (Private key). E.g. — RSA, ECC
- Hash functions - A one-way algorithm that doesn’t need a key. It will convert the message into a fixed-length output (hash value), which is designed to be computationally infeasible to reverse.
- E.g. — SHA-1, SHA-256, MD5, MD6
Actually, there’s some interesting maths behind the scenes. But today is not the day for that. For now, give these algorithms a try.
https://gchq.github.io/CyberChef/#recipe=SHA2('256',64,160)&input=Y3J5cHRvZ3JhcGh5
CyberChef is basically our Swiss knife for cryptography. Try out the algorithms, tweak the values, and get the feel for these algorithms.
Where can we see this?
- Password Security - Passwords are hashed before storing, which ensures safety
- Secure Web Browsing (HTTPS) - Using a combination of symmetric, asymmetric, and hashing methods.
- Authentication Systems - In systems with passwords, only the hash value will be checked. The password never leaves the device. In passwordless systems, asymmetric cryptography is used.
- End-to-End Encryption - Messaging apps like WhatsApp use this to secure messages.
Cryptography is not bulletproof
LastPass password manager experienced it firsthand. In 2022, their encrypted customer vault backups were stolen. The cryptographic algorithm never failed. But cryptography is only as strong as the password. Once the attackers had access to the encrypted data offline, it was just a matter of time before they cracked weak passwords and potentially decrypted the vault data. Without any rate limit, they were able to brute-force their way through the easy passwords pretty quickly.
Zero-Trust Architecture - Limit who can reach the data
Remember how our parents always told us never to trust strangers. This is basically that but in a technology context.
Zero Trust Architecture (ZTA) is a cybersecurity architecture based on the principle “Never Trust, Always Verify”.
The traditional approach was: if you are inside the system network, you are trusted.
This is not good for a secure system. That is why we needed a secure method.
Get Binuka Perera’s stories in your inbox
Join Medium for free to get updates from this writer.
According to NIST (National Institute of Standards and Technology), there are 7 pillars of ZTA. But for simplicity, we’ll go with Microsoft’s 3-pillar framework.
- Verify explicitly - Instead of verifying only at the entry point, every access should be verified
- Use least-privilege access - Do not give users access more than they absolutely need. Always grant the minimum level of access for their tasks.
- Assume breach - Always assume that everyone and everything can be breached. That includes anticipating that users, devices, and local systems can already be compromised.
The hard lesson
Google introduced its new Zero Trust Architecture - “BeyondCorp”, after it was breached in 2009 (Operation Aurora). Google had to stop treating the corporate network as a trusted boundary and move to a more user, device, and context-based system.
Penetration Testing - Verify the shields are working
Alright, we did everything. Encryption in place, zero trust implemented. But did we do everything right?
The above were just some main aspects that we can use to make a system secure. There are so many more that we should consider. And remember, “Defenders have to be right every time. Attackers only need to be right once” (defender’s dilemma).
That’s why we need a way to test out the systems constantly. That’s penetration testing, or more popularly known as pentesting.
Pentesting is a security exercise where a cybersecurity expert attempts to find and exploit vulnerabilities in a computer system. So basically, hacking the system.
There are three commonly discussed types of hackers:
- White hat - Hacks with permission. Reports what they find.
- Black hat - Hacks without permission for personal gain or harm
- Gray hat - Hacks without permission but without malicious intent. Reports what they find.
Bug Zero is a Sri Lankan platform that connects security researchers / ethical hackers with companies. It offers various security testing and bug bounty programs.
Bug bounty programmes are deals offered by organizations to reward individuals for finding security vulnerabilities. Even you can find vulnerabilities and get rewarded through these programs.
A more popular such program is the Google Vulnerability Reward Program (VRP), which has been around since 2010.
Conclusion
These are just a handful of methods used in securing the modern digital world. There can be all these advanced techniques invented, but they wouldn’t matter if you are not using them. Take a closer look at your systems, devices and products you build (websites, applications). Are they really secure?
Secure them, test them, and test them again. Because once again, an attacker only needs one flaw.
References
- GeeksforGeeks. Cryptography and its Types. — Source for the three cryptography types (symmetric, asymmetric, hash functions) and their examples (DES/AES, RSA, SHA/MD5/MD6). https://www.geeksforgeeks.org/computer-networks/cryptography-and-its-types/
- GCHQ. CyberChef — “The Cyber Swiss Army Knife.” — The interactive tool referenced for trying out cryptographic algorithms. https://gchq.github.io/CyberChef/
- Wikipedia; KrebsOnSecurity. LastPass 2022 Data Breach. — Source for the LastPass case study: encrypted vault backups stolen, security dependent on master password strength, and the breach’s real consequences. https://en.wikipedia.org/wiki/LastPass
- National Institute of Standards and Technology. Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture (NIST Special Publication 800–207). — Source for the 7-tenet NIST model. https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=930420
- Microsoft. What is Zero Trust Architecture? — Source for the 3-principle framework (verify explicitly, least privilege, assume breach). https://www.microsoft.com/en-us/security/business/security-101/what-is-zero-trust-architecture
- Google Cloud. BeyondCorp: A New Approach to Enterprise Security. — Source for Google’s Zero-Trust origin story, built in response to the 2009 Operation Aurora attack. https://cloud.google.com/beyondcorp
- Cloudflare. What is Penetration Testing? — Source for the pentesting definition used in the article. https://www.cloudflare.com/learning/security/glossary/what-is-penetration-testing/
- Bug Zero. Bug Zero — Sri Lanka’s Bug Bounty Platform. — Source for the Bug Zero description as a Sri Lankan platform connecting ethical hackers with companies. https://bugzero.io/
- Google. Google and Alphabet Vulnerability Reward Program (VRP) Rules. — Source for the claim that Google’s VRP has run continuously since 2010. https://bughunters.google.com/about/rules/google-friends/google-and-alphabet-vulnerability-reward-program-vrp-rules
- Shodan. Shodan Search Engine. — The device-exposure search engine referenced in the introduction’s opening activity. https://www.shodan.io/
Written by Binuka Perera.
Think you’ve got it? 🔥
Read the blog carefully and then give the quiz a try!
Earn points every week by answering correctly and climb the leaderboard for a chance to win Rs. 4,000 at the end of the month! 🏆
🔴 Terms & Conditions apply.
